Vulnerabilities > CVE-2013-1661 - Improper Input Validation vulnerability in VMWare ESX and Esxi
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
VMware ESXi 4.0 through 5.1, and ESX 4.0 and 4.1, does not properly implement the Network File Copy (NFC) protocol, which allows man-in-the-middle attackers to cause a denial of service (unhandled exception and application crash) by modifying the client-server data stream.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
OS | 14 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Server Side Include (SSI) Injection An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
- Cross Zone Scripting An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
- Cross Site Scripting through Log Files An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
- Command Line Execution through SQL Injection An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
Nessus
NASL family VMware ESX Local Security Checks NASL id VMWARE_VMSA-2013-0011.NASL description a. VMware ESXi and ESX NFC Protocol Unhandled Exception VMware ESXi and ESX contain a vulnerability in the handling of the Network File Copy (NFC) protocol. To exploit this vulnerability, an attacker must intercept and modify the NFC traffic between ESXi/ESX and the client. Exploitation of the issue may lead to a Denial of Service. To reduce the likelihood of exploitation, vSphere components should be deployed on an isolated management network VMware would like to thank Alex Chapman of Context Information Security for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2013-1661 to this issue. last seen 2020-06-01 modified 2020-06-02 plugin id 69550 published 2013-09-03 reporter This script is Copyright (C) 2013-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/69550 title VMSA-2013-0011 : VMware ESXi and ESX address an NFC Protocol Unhandled Exception NASL family Misc. NASL id VMWARE_ESXI_5_1_BUILD_1142907_REMOTE.NASL description The remote VMware ESXi 5.1 host is affected by an unspecified error related to handling Network File Copy (NFC) traffic that could allow denial of service attacks. last seen 2020-06-01 modified 2020-06-02 plugin id 70887 published 2013-11-13 reporter This script is (C) 2013-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/70887 title ESXi 5.1 < Build 1142907 NFC Traffic Denial of Service (remote check) NASL family Misc. NASL id VMWARE_ESXI_5_0_BUILD_1197855_REMOTE.NASL description The remote VMware ESXi 5.0 host is affected by an unspecified error related to handling Network File Copy (NFC) traffic that could allow denial of service attacks. last seen 2020-06-01 modified 2020-06-02 plugin id 70878 published 2013-11-13 reporter This script is (C) 2013-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/70878 title ESXi 5.0 < Build 1197855 NFC Traffic Denial of Service (remote check) NASL family Misc. NASL id VMWARE_ESX_VMSA-2013-0011_REMOTE.NASL description The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by a denial of service vulnerability in the Network File Copy (NFC) protocol due to improper handling of specially crafted NFC traffic. A man-in-the-middle attacker can exploit this to cause an unhandled exception and application crash, resulting in a denial of service condition. last seen 2020-06-01 modified 2020-06-02 plugin id 89667 published 2016-03-04 reporter This script is Copyright (C) 2016-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/89667 title VMware ESX / ESXi NFC Traffic Handling DoS (VMSA-2013-0011) (remote check)
Seebug
bulletinFamily | exploit |
description | BUGTRAQ ID: 62077 CVE(CAN) ID: CVE-2013-1661 VMware ESX Server是为适用于任何系统环境的企业级虚拟计算机软件 ESXi 4.0, 4.1, 5.0, 5.1、ESX 4.0, 4.1 在处理NFC协议时存在远程拒绝服务漏洞,要利用此漏洞,攻击者需要截获并修改ESXi/ESX和客户端之间的NFC流量,利用成功后可导致拒绝服务 0 VMWare ESX 4.1 VMWare ESX 4.0 VMWare ESXi 5.0 VMWare ESXi 4.1 VMWare ESXi 4.0 厂商补丁: VMWare ------ VMWare已经为此发布了一个安全公告(VMSA-2013-0011)以及相应补丁: VMSA-2013-0011:VMware ESXi and ESX address an NFC Protocol Unhandled Exception 链接:https://www.vmware.com/support/support-resources/advisories/VMSA-2013-0011.html 补丁下载: ------------ https://www.vmware.com/patchmgr/download.portal ESXi 5.1 -------- File: ESXi510-201307001.zip md5sum: 24065646806665d176a373bf9a861f98 sha1sum: c07a9361df8d9adcd2ff1f8e949d41fbeb091f0f http://kb.vmware.com/kb/2052151 ESXi510-201307001 contains ESXi510-201307101-SG ESXi 5.0 ------------------ File: ESXi500-201308001.zip md5sum: 90d20a6921f35ededfc5021afeedc63f sha1sum:e739a671ab0bc9820fef90dc7ca4445eeb6a056d http://kb.vmware.com/kb/2053139 ESXi500-201308001 contains ESXi500-201308101-SG ESXi 4.1 ------------------ File: ESXi410-201304001.zip md5sum: 9ce63bcacb3412fc1c8a6a8c47ac6af6 sha1sum: 241603ef6b856e573a62fe27da039c8fffe54b1d http://kb.vmware.com/kb/2045255 ESXi410-201304001 contains ESXi410-201304401-SG ESXi 4.0 ------------------ File: ESXi400-201305001.zip md5sum: 065d3fa4b0f52dd38c2bd92e5bfc5580 sha1sum: 1f3cab25a144746372d86071a47e569c439e276a http://kb.vmware.com/kb/2044246 ESXi400-201305001 contains ESXi400-201305401-SG ESX 4.1 -------- File: ESX410-201304001.zip md5sum: df9ef1d25f383a12d2fbc47cdc5f55d2 sha1sum: e49068da7cf7e0ada57c4604cbc9ba253c03e3a0 http://kb.vmware.com/kb/2045251 ESX410-201304001 contains ESX410-201304401-SG ESX 4.0 ------- File: ESX400-201305001.zip md5sum: c9ac91d3d803c7b7cb9df401c20b91c0 sha1sum: 7f5cef274c709248daa56d8c0e6fcc1ba86ae411 http://kb.vmware.com/kb/2044242 ESX400-201305001 contains ESX400-201305401-SG |
id | SSV:60991 |
last seen | 2017-11-19 |
modified | 2013-09-03 |
published | 2013-09-03 |
reporter | Root |
title | VMware ESXi及ESX NFC协议处理远程拒绝服务漏洞 |